{"id":2567462,"url":"https://alion.io/job/aspen-view-tech-senior-threat-hunter","title":"Threat Hunting Analyst","company":{"id":4431613,"name":"AspenView Technology Partners","domain":"aspenviewtech.com","url":"https://alion.io/company/aspen-view-tech","size_band":null,"is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bogotá, Colombia"],"countries":["CO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":35000,"max_usd":81000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MISP","optional":false},{"name":"Okta","optional":false},{"name":"OpenCTI","optional":false},{"name":"Python","optional":false},{"name":"Recorded Future","optional":false},{"name":"SentinelOne","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-10-05T18:01:41Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-21T16:58:53Z","board_verified":true,"closed_at":null,"days_open":16,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":16},"description":"Build the Future with AspenView Technology Partners\nAt AspenView, we are passionate about transforming the way organizations approach technology. We specialize in creating high-performing, nearshore IT teams to help North American clients innovate faster and more efficiently.\nAs we continue to grow, we’re looking for exceptional people to join our team and help drive impactful change across industries.\nWhy Join AspenView?\nAt AspenView, we’re more than a nearshore IT partner-we’re a people-first, purpose-driven company that believes great culture drives great outcomes. We’re passionate about connecting talent and technology to deliver measurable value for clients-and meaningful career paths for our people.\nHere’s what you can expect:\nCompetitive base\nFlexible work model: hybrid, remote, or in-office\nReal growth opportunities and leadership visibility\nInclusive, respectful culture that blends U.S. innovation with Colombian heart\nA company that listens, invests in you, and celebrates wins together\nWe are seeking a Threat Hunter Analyst to join the security operations team of a large US consumer lender in the financial services sector, working on-site from AspenView's secure suite in Bogotá, Medellín or Buenos Aires. You'll design and run hypothesis-driven hunts across endpoint, identity, network, email and AWS telemetry in Elastic, reporting to the on-site Threat Hunting Lead and working closely with Detection Engineering so that every good hunt ends as a working detection. This is a hands-on role for someone who can take raw intelligence and turn it into a hunt without being told how, and who knows what living-off-the-land, credential abuse and lateral movement look like in real logs, not just someone who has triaged alerts from a queue.\nWhat you will do:\nHunt Design & Threat Intelligence\nBuild hunts from threat intelligence relevant to US consumer finance, recent incidents and known telemetry gaps\nTurn raw intelligence into testable hypotheses on your own\nDecide which data sources and timeframes will answer each hunt question\nMap attacker tradecraft to MITRE ATT&CK to shape and prioritize hunts\nHunt Execution & Investigation\nRun scheduled and ad hoc hunts across CrowdStrike, Defender, Okta, Palo Alto, Proofpoint and AWS data in Elastic\nPivot quickly when an initial query surfaces something worth chasing\nSeparate real findings from noise\nEscalate live attacker activity to Tier 3 and the Incident Response Lead with the evidence attached\nRun indicator and behaviour sweeps during major incidents to scope how far an attacker reached\nDetection Engineering Partnership\nHand candidate detections to Detection Engineering, written well enough to build from\nIdentify logging gaps and document them for remediation\nMake sure your hunts end as production detection rules\nReporting & Knowledge Sharing\nWrite clear, reproducible hunt reports covering what was tested, found, ruled out and couldn't be tested\nWalk the client's security team through findings directly, in English\nDocument hunts so anyone on the team can rerun them\nTools & Technologies:\n Platforms & Infrastructure: Elastic Security (EQL, ES|QL), Splunk or Microsoft Sentinel (equivalent SIEMs), Palo Alto, Proofpoint\nSecurity & Threat Intelligence: CrowdStrike Falcon, Microsoft Defender, SentinelOne, MITRE ATT&CK, MISP, OpenCTI, Recorded Future, FS-ISAC, malware triage and memory forensics\n Cloud & Data Analysis: AWS (control-plane and cloud telemetry), Okta (identity telemetry), Python, Jupyter\nWhat you bring: \nExperience: 3+ years in threat hunting, Tier 3 investigation or incident response, with hunts you can walk through from hypothesis to outcome, including the ones that found nothing\nTechnical Depth: Fluent querying across large data sets in Elastic, Splunk, Sentinel or equivalent, and a strong grasp of living-off-the-land, credential and session abuse, lateral movement and cloud control-plane abuse as they appear in logs\nConsulting / Leadership: Confidence presenting findings straight to a US client's security team, working well with Detection Engineering and IR, and interest in growing into a Threat Hunting Lead, IR Lead or Detection Engineering Lead role\nMindset: Works independently, stays rigorous and curious, and knows that a hunt proving a control works is a good result\nLanguage: English at B2 or above\n Location & Schedule: On-site in Bogotá, Medellín or Buenos Aires during US Eastern business hours (no rotating shifts), with occasional call-ins during major incidents\nSecurity Clearance: Willing to undergo identity, criminal-background, employment and education checks, repeated periodically, and to work in a clean-desk, VDI-only environment\nClearance: Must pass identity, criminal-background, employment and education checks, repeated periodically.\n Nice to have: Financial-sector threat experience (fraud-motivated intrusion, ransomware, BEC), detection-writing skills, and certifications such as GCTI, GDAT, GCIH, GCFA or eCTHP\nVisa Sponsorship\nAspenView does not sponsor employment visas for this role. Applicants must be permanently authorized to work in their country of residence and must not require visa sponsorship now or in the future.\nEqual Opportunity Employer\nAspenView is proud to be an equal opportunity employer. We believe in creating an environment where all employees feel welcome, valued, and empowered to succeed. We celebrate diversity and strive to build a culture of inclusion where all individuals, regardless of their race, color, gender, gender identity or expression, sexual orientation, disability, age, or any other characteristic, can thrive. We encourage applicants from all walks of life to join our team and make a lasting impact.","description_format":"text","description_chars":5701,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":["Flexible schedule","Growth opportunities"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Colombia","iso":"CO","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-14T22:14:01Z"}],"visa":[],"liveness":{"score":35,"band":"fade","label":"Fading","p_open":1,"p_active":0.472,"p_room":0.75,"age_days":15,"expected_fill_days":22,"reasons":["conf:2","agency","velocity","win:late"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/aspen-view-tech-senior-threat-hunter","json_url":"https://alion.io/job/aspen-view-tech-senior-threat-hunter.json","meta":{"generated_at":"2026-10-21T19:24:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27449,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4431613},"rest":"https://alion.io/mcp/rest/get_company?id=4431613"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faspen-view-tech-senior-threat-hunter"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faspen-view-tech-senior-threat-hunter"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faspen-view-tech-senior-threat-hunter"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aspen-view-tech-senior-threat-hunter\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faspen-view-tech-senior-threat-hunter"}]}